WebApp Sec mailing list archives
Re: Should or shouldn't block public ping to a website
From: "Sandeep Cheema " <51l3n7 () live in>
Date: Fri, 9 Sep 2011 10:46:33 +0000
Why are you not allowing ICMP? Is the server itself exposed or behind a netscaler or some routing device? Even if it's not covered behind, you can allow ping. The only exploit with ping is the ping of death, which is obsolete now. Use a software IDS\IPS? Regards, Sandeep Sent from BlackBerry® on Airtel -----Original Message----- From: ShiYih Lye <shiyih.lye () my offgamers com> Date: Mon, 5 Sep 2011 06:03:57 To: <webappsec () securityfocus com>; <pen-test () securityfocus com> Subject: Should or shouldn't block public ping to a website Hi, All this while I'm not allowing any public ping to the website I'm maintaining, but it's making me tougher to troubleshoot should any user from the globe having trouble to access our website, as I can't make them to send a proper traceroute report. To your opinion, is it necessary to block public ping to a public website ? Is this security practice still relevant in today exploit technology ? And if you think it's still necessary, how do I make sure my user's traceroute still work when all ICMP is dropped from public ? Thanks for any input, appreciated that. Regards, Lye This list is sponsored by Cenzic -------------------------------------- Let Us Hack You. Before Hackers Do! It's Finally Here - The Cenzic Website HealthCheck. FREE. Request Yours Now! http://www.cenzic.com/2009HClaunch_Securityfocus -------------------------------------- This list is sponsored by Cenzic -------------------------------------- Let Us Hack You. Before Hackers Do! It's Finally Here - The Cenzic Website HealthCheck. FREE. Request Yours Now! http://www.cenzic.com/2009HClaunch_Securityfocus --------------------------------------
Current thread:
- Should or shouldn't block public ping to a website ShiYih Lye (Sep 09)
- Message not available
- Re: Should or shouldn't block public ping to a website ShiYih Lye (Sep 09)
- Re: Should or shouldn't block public ping to a website Andre Correa (Sep 11)
- Re: Should or shouldn't block public ping to a website John Hall (Sep 11)
- Re: Should or shouldn't block public ping to a website ShiYih Lye (Sep 09)
- Message not available
- Re: Should or shouldn't block public ping to a website MATHDATER (Sep 11)
- <Possible follow-ups>
- Re: Should or shouldn't block public ping to a website Sandeep Cheema (Sep 11)
- Re: Should or shouldn't block public ping to a website Clement Dupuis (Sep 12)
- RE: Should or shouldn't block public ping to a website Martin O'Neal (Sep 13)
- RE: Should or shouldn't block public ping to a website Martin O'Neal (Sep 14)